We recently deployed a project on a preproduction environment and we noticed that on the admin panel (logged in as an Administrator), the “Update” submenu wasn’t showing at all.
When we try to access the page by entering the url directly (…/update-core.php) we get this message :
“Sorry, you are not allowed to access this page.”
We get this message even tho we are logged in as an Administrator.
For our Editors users, the “Appearance” menu element is not showing either, and shows the same error message when the url is accessed directly.
We saw this page from your documentation mentioning that the problem might come from one of our plugins or our theme.
But even after deactivating every plugins and the theme, the problem persists and theses pages are still not available for those roles.
Can the problem be from Bedrock itself ? Or maybe is it our server configuration / our .htaccess that has some conflicts with Bedrock ?
We are using Bedrock + Sage 9.0.9, and PHP 7.3.18 on a WordPress 5.4.2.
The updater is disabled on purpose by Bedrock so that dependencies can be managed by composer. If you allow updates through the admin panel, then your composer.json file becomes outdated and you can’t reliably deploy. Not being able to update through WordPress is the intended behavior, but if you really need it you can modify this line in your config https://github.com/roots/bedrock/blob/ed4aeaff01347074e3bf46bd9ab116b19c8929cb/config/application.php#L99
The entire appearance menu disappearing is odd, but Bedrock does disable the file editor that usually appears there and allows you to edit theme and plugin files. It does this because if files are edited in a production environment then your repo will quickly fall out of sync and you will be unable to reliably deploy. If you really need that feature, you can re-enable it with this line in the config: https://github.com/roots/bedrock/blob/ed4aeaff01347074e3bf46bd9ab116b19c8929cb/config/application.php#L97
The specific lines I’ve pointed you towards are the environment-agnostic settings: you can also modify the settings on a per-environment basis (see the development.php and staging.php files in the config/environments directory).
I also strongly recommend reading Twelve-Factor WordPress App, especially the “Dependencies” section, which explains why the Roots stack does many of the things it does (including the above behavior).